[PR #1884] [CLOSED] fix(javascript): resolve ESM package self references #4878

New issue

Closed

opened 2026-10-31 00:56:18 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:18 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1884
Author: @xu91102
Created: 10/11/2026
Status: ❌ Closed

Base: main ← Head: fix/esm-package-self-references

📝 Commits (1)

ef91773 fix(javascript): resolve ESM package self references

📊 Changes

2 files changed (+96 additions, -3 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+3 -3)
➕ tests/acceptance/applications/packageSelfReferencesCli.test.ts (+93 -0)

📄 Description

Summary

ESM package self-references were marked external even when the package's exact exported files were inventoried. Resolve them through the nearest package's name and exports before dependency lookup, using the import loader's conditions. Fixes #1881.

Problem and expected behavior

import { answer } from "rea-self-fixture/feature" loads successfully in Node, but previously produced resolved_path: null and resolution_status: "external". It now resolves to the exported internal file and retains its binding relationship and source provenance.

Change and scope

Reuse the existing self-reference scope walk and exports selector for both named loaders. Rename the former CommonJS-only helper to describe its shared responsibility. Keep the existing nearest-package, container-identity, blocked-export, and exact-target rules.

Contract and boundary impact

Semantic owner and earliest changed stage: application-layer artifact module resolution.
CLI and MCP/tool-catalog contract: unchanged schemas; both surfaces now report the correct local import target.
Provider, bridge, target-format, or platform compatibility: static JavaScript package analysis; no engine or bridge changes.
Evidence, artifact, provenance, or reconstruction contract: retain caller specifiers, source ranges, source digests, and container identity.
Process execution, authorization, cleanup, or containment impact: none in production; resolution operates on the existing inventory.
Generated metadata, package, or installation impact: none.

Evidence and regression coverage

New compiled CLI and stdio MCP acceptance coverage checks package-root/subpath self imports, different import/require targets, and original source digest/location.
A real Node subprocess independently loads the same source-owned fixture and prints 11 22.
On base fb94d9dde0ccda83ae520ac6fb22b1d283562cf3, both new surface tests failed because the expected internal imports were external. Both pass after the fix.
Existing CommonJS self-reference, nearest-package-scope, foreign-container, blocked/missing exports, and package-subpath tests pass.
Review: self-review of the fixed base, complete patch, and new acceptance test; no actionable findings.
Remaining proof gaps: full deterministic coverage is left to upstream CI; real native engines and browser runtime are outside this static resolution change.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

All local checks used Node 24.18.0 / npm 11.16.0 on macOS 27.0.1 arm64.

npm run test:focused -- tests/acceptance/applications/packageSelfReferencesCli.test.ts before the production fix — 2 expected regression failures.
npm run test:focused -- tests/acceptance/applications/packageSelfReferencesCli.test.ts tests/acceptance/applications/packageSubpathsCli.test.ts tests/boundary/javascript/packageConditionalExports.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts — 152 tests passed across 4 files, including freshly built CLI/MCP workflows.
npm run check — passed typecheck, lint, formatting, knip, metadata, module boundaries, and architecture guards; 758 lint warnings, zero errors.
npm run verify:test-discovery — all 843 test files discovered exactly once.
git diff --check — passed.
Upstream CI — awaiting maintainer approval for this fork contribution (action_required); no CI jobs have executed. This is not counted as a passing check.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: actual Node resolver and REA CLI/MCP on macOS; no native-provider or browser-runtime claim.
Package or release metadata impact: none.
Security, privacy, process, or containment review: same-container checks and artifact-root confinement remain enforced; no new process authority or external fetches.

Review checklist

This PR addresses a concrete reproduced problem and has one focused outcome.
The title follows Conventional Commits and the related issue is linked.
Tests cover observable behavior and existing refusal/scope paths.
No owning docs, schemas, or generated metadata require changes.
Representative CLI/MCP output and actual validation are recorded above.
The final diff contains no secrets, unrelated cleanup, or unsupported provider claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1884 **Author:** [@xu91102](https://github.com/xu91102) **Created:** 10/11/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/esm-package-self-references` --- ### 📝 Commits (1) - [`ef91773`](https://github.com/morluto/rea/commit/ef917732a853b0801626cb0062440a77c8ae1ac8) fix(javascript): resolve ESM package self references ### 📊 Changes **2 files changed** (+96 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+3 -3) ➕ `tests/acceptance/applications/packageSelfReferencesCli.test.ts` (+93 -0) </details> ### 📄 Description ## Summary ESM package self-references were marked external even when the package's exact exported files were inventoried. Resolve them through the nearest package's `name` and `exports` before dependency lookup, using the import loader's conditions. Fixes #1881. ## Problem and expected behavior `import { answer } from "rea-self-fixture/feature"` loads successfully in Node, but previously produced `resolved_path: null` and `resolution_status: "external"`. It now resolves to the exported internal file and retains its binding relationship and source provenance. ## Change and scope Reuse the existing self-reference scope walk and exports selector for both named loaders. Rename the former CommonJS-only helper to describe its shared responsibility. Keep the existing nearest-package, container-identity, blocked-export, and exact-target rules. ## Contract and boundary impact - Semantic owner and earliest changed stage: application-layer artifact module resolution. - CLI and MCP/tool-catalog contract: unchanged schemas; both surfaces now report the correct local import target. - Provider, bridge, target-format, or platform compatibility: static JavaScript package analysis; no engine or bridge changes. - Evidence, artifact, provenance, or reconstruction contract: retain caller specifiers, source ranges, source digests, and container identity. - Process execution, authorization, cleanup, or containment impact: none in production; resolution operates on the existing inventory. - Generated metadata, package, or installation impact: none. ## Evidence and regression coverage - New compiled CLI and stdio MCP acceptance coverage checks package-root/subpath self imports, different import/require targets, and original source digest/location. - A real Node subprocess independently loads the same source-owned fixture and prints `11 22`. - On base `fb94d9dde0ccda83ae520ac6fb22b1d283562cf3`, both new surface tests failed because the expected internal imports were external. Both pass after the fix. - Existing CommonJS self-reference, nearest-package-scope, foreign-container, blocked/missing exports, and package-subpath tests pass. - Review: self-review of the fixed base, complete patch, and new acceptance test; no actionable findings. - Remaining proof gaps: full deterministic coverage is left to upstream CI; real native engines and browser runtime are outside this static resolution change. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed All local checks used Node 24.18.0 / npm 11.16.0 on macOS 27.0.1 arm64. - `npm run test:focused -- tests/acceptance/applications/packageSelfReferencesCli.test.ts` before the production fix — 2 expected regression failures. - `npm run test:focused -- tests/acceptance/applications/packageSelfReferencesCli.test.ts tests/acceptance/applications/packageSubpathsCli.test.ts tests/boundary/javascript/packageConditionalExports.test.ts src/application/javascript/JavaScriptArtifactPathResolution.test.ts` — 152 tests passed across 4 files, including freshly built CLI/MCP workflows. - `npm run check` — passed typecheck, lint, formatting, knip, metadata, module boundaries, and architecture guards; 758 lint warnings, zero errors. - `npm run verify:test-discovery` — all 843 test files discovered exactly once. - `git diff --check` — passed. - [Upstream CI](https://github.com/morluto/rea/actions/runs/38153049896) — awaiting maintainer approval for this fork contribution (`action_required`); no CI jobs have executed. This is not counted as a passing check. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: actual Node resolver and REA CLI/MCP on macOS; no native-provider or browser-runtime claim. - Package or release metadata impact: none. - Security, privacy, process, or containment review: same-container checks and artifact-root confinement remain enforced; no new process authority or external fetches. ## Review checklist - [x] This PR addresses a concrete reproduced problem and has one focused outcome. - [x] The title follows Conventional Commits and the related issue is linked. - [x] Tests cover observable behavior and existing refusal/scope paths. - [x] No owning docs, schemas, or generated metadata require changes. - [x] Representative CLI/MCP output and actual validation are recorded above. - [x] The final diff contains no secrets, unrelated cleanup, or unsupported provider claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:18 +00:00